fremai Data Protection Impact Assessment — AI-inference processing

title: fremai Data Protection Impact Assessment — AI-inference processing author: fremverk date: 2026-08-13 version: “1.0” status: Published v1.0 lang: en #

Last updated: 2026-08-13

Effective Date: 2026-08-13 — Version: 1.0 (see the change log for the effective date of each amendment)

This Data Protection Impact Assessment (“DPIA”) covers the AI-inference processing performed by the fremai service at fremai.eu, conducted under GDPR Art. 35. It is fremai-specific — a distinct assessment reflecting fremai’s inference-reseller processing and its metadata-only / no-content posture — and complements fremai ROPA §3.1 and DPA Annex A.

1. Description of the processing #

1.1 Nature #

fremai is an EU-sovereign, OpenAI-compatible AI-inference reseller. A Customer changes its OpenAI SDK baseURL to https://api.fremai.eu/v1; fremai routes each inference request to a third-party EU-sovereign inference backend (the “Backend”, per DPA Annex B) and returns the completion. fremverk acts as the Customer’s processor; the Backend is fremverk’s sub-processor.

The defining characteristic is metadata-only / no-content (DPA §5, Annex A.1): prompt and completion bodies are processed only transiently in memory to route the request and are never persisted, logged, or used to train any model. Only token-usage metadata is retained.

1.2 Scope #

1.3 Purposes and lawful basis #

• Provide the contracted inference service — Art. 6(1)(b), performance of contract (processor on Customer instruction).
• Meter, bill, secure, and rate-limit — Art. 6(1)(b) and Art. 6(1)(f) legitimate interest.
• The Customer is controller for any personal data it places in prompts and is responsible for its own lawful basis toward the data subjects concerned.

1.4 Stakeholders consulted #

• Privacy contact — privacy@fremai.eu.
• Engineering / controller — fremverk ApS.
• Supervisory authority — not formally consulted at DPIA stage; Art. 36 prior consultation is required only if residual risk remains high after mitigation (§6, preliminary).

2. Necessity and proportionality #

The processing is strictly necessary to deliver the service the Customer requests: routing a prompt to a model and returning a completion cannot be done without transiently processing the request body.

Proportionality is served primarily by data minimisation at the architectural level:

• No content retention — the largest and most sensitive data class (prompt/completion bodies) is never persisted, so the retention, re-identification, and secondary-use risks that dominate most AI-service DPIAs are structurally removed rather than merely mitigated.
• No content inspection / no training — fremai runs no safety classifier, DLP, or logging of bodies by default (DPA §5; design §4.12), and neither fremverk nor the Backend uses content or metadata to train, fine-tune, or evaluate any model.
• Metadata minimised — only token counts, model id, latency, status, cost, key id, and timestamp are retained; these are the same figures fremverk is billed on.

Lower-impact alternatives considered: (a) response/semantic caching — rejected by default because it would store content (DPA §5); (b) content moderation in-path — rejected as the default because it contradicts the no-inspection invariant, offered only as an explicit, separately-disclosed opt-in tier (design §4.18 #7).

3. Risks to the rights and freedoms of data subjects #

The risk ratings below are preliminary (severity and likelihood 1–5, net = product) and must be re-run under counsel review before publication.

4. Mitigations #

• R1 — content-path hardening. TLS 1.2+ on every hop; inference TLS terminates inside the T Cloud Public tenant with no CDN in the inference path (DPA §11, Annex A.2–A.3), so no third-party edge ever sees plaintext prompts. Backend serves inference from ephemeral, zero-retention execution.
• R2 / R4 — metadata minimisation + purpose limitation. Only billing/security metadata is retained (Annex A.1, A.6); abuse controls act on metadata only and feed the audit trail, not marketing or profiling. Raw per-request metadata is held in a short hot tier (90 days); audit metadata is 3-year WORM; account records are life-of-tenancy plus audit window.
• R3 — no content at rest + logical tenant isolation. Because content is never persisted, there is no standing corpus to correlate against. Tenant isolation is logical (LiteLLM org/team/user/key scoping
  • control-plane row-level security), and the Customer controls what it places in prompts.
• R5 — CLOUD Act / ownership due diligence. EU-only residency on non-US-parented entities is the design posture (DPA §11); confirmation that the Backend has no US parent or controlling interest is a partner-due-diligence must-have (assessed — see DPA §11). SEPA is offered to avoid the card-network chain’s US parents on the payment path.
• R6 — contractual zero-retention on the reseller path. The DPA §5 zero-retention/no-training commitment must be confirmed to extend to the reseller path in the executed Backend partner agreement (Backend commits publicly; contractual clause outstanding — DPA §5).
• Encryption at rest for the metering/account database, cache, and object storage with fremverk-managed DEW KMS keys (Annex A.3).

5. Residual risk (preliminary) #

The residual ratings below assume the mitigations in §4 are in force and the two partner-DD confirmations (R5, R6) land as expected. They are preliminary and counsel-review-gated; where a mitigation depends on an unexecuted partner agreement, the residual cannot be finalised until that agreement is confirmed.

6. Article 35 trigger assessment and conclusion (preliminary) #

A DPIA is undertaken on a precautionary basis given (a) the processing involves a new technology (large-scale AI inference) and (b) prompt content may contain personal data of unknown categories chosen by the Customer. The metadata-only / no-content architecture removes the large-scale-storage and systematic-monitoring triggers that would otherwise weigh toward a mandatory DPIA.

Preliminary conclusion: subject to counsel review and to the two outstanding partner-DD confirmations (R5, R6), the residual risk to the rights and freedoms of natural persons is expected to be low, and prior consultation with the supervisory authority under Art. 36 is not anticipated to be required. This conclusion must not be treated as final until (i) legal counsel has reviewed this DPIA and (ii) the executed Backend partner agreement confirms the no-US-parent (R5) and reseller-path zero-retention (R6) positions. If either confirmation fails, R5/R6 residuals rise and the Art. 36 assessment must be re-run.

7. Outstanding items #

• R5 — resolved, and the answer is recorded rather than assumed. The Backend is Irish-incorporated and its inference path is wholly EU-located (France, Ireland, Finland). One entity on that path, the Dublin colocation provider, has a US parent; DPA §11 states this openly and explains why it creates no practical CLOUD Act exposure. Residual risk is reassessed on that basis rather than left contingent.
• R6 — partially resolved. The Backend publishes an unconditional zero-retention and no-training commitment covering all of its customers. Securing the equivalent clause in the executed reseller agreement remains an action, because a contractual term is the enforceable form of a published one.
• Retention window for raw per-request usage metadata is set at 90 days and enforced by an automated deletion job, not by policy alone.
• Counsel review of all risk ratings, residuals, and the Art. 35/36 conclusion.

8. Change log #